Q: I read in the New York Times that in 2007, the most recent year for which data are available, more than 250,000 Americans were affected by medical identity theft. Do you have tips to help me avoid theft?

A: Yes, and according to that New York Times article it is no longer unusual for medical office “insiders” to steal information and sell it, or to file false claims. In fact the number in that story has probably gone up with increased use of electronic medical records.

Also, the World Privacy Forum released a report in 2006 titled “Medical Identity Theft: The Information Crime that Can Kill You.” Access the report here.

ProAssurance risk managers often field questions about stolen medical records. In fact, two recent instances occurred in Indiana. In one case, a physician’s car was broken into, and billing sheets with patients’ personal health information were stolen. On another occasion, a patient in an exam room, allegedly angry at the wait time, left the office and took the medical record.

While neither case is as weighty as full-scale medical identity theft, physicians can use some of the same safeguards they use to reduce their risks with stolen records to also protect against medical identity theft.

If records are stolen by someone other than the patient, risk management experts recommend:

• File a police report. If possible, contact the patient to obtain permission to do so, since even though the record is yours, the information within is protected patient information.
• Notify the patient that his/her personal health information and personal identification information were stolen. Also, note this as a HIPAA unauthorized disclosure as the medical record is being re-created.
• Clearly note that the medical record is being re-created.
• Contact your general liability insurance company and explain the theft.
• File a police report if a patient steals the medical record. Call the patient to ask that the record be immediately returned and note the day and time the record is returned. If the patient does not return the record, document that as well.
• Ensure that employees/office staff members have signed confidentiality agreements that reiterate the importance of patient confidentiality.